Slashdot Mirror
Insider Threat
Ben Rothke writes "Thousands of computer security books have been published that deal with every conceivable security issue and technology. But Insider Threat is one of the first to deal with one of the most significant threats to an organizations, namely that of the trusted insider. The problem is that within information technology, many users have far too much access and trust than they should truly have." Read the rest of Ben's review.
Insider Threat
author
Eric Cole and Sandra Ring
pages
397
publisher
Syngress
rating
9
reviewer
Ben Rothke
ISBN
1597490482
summary
Excellent overview of the insider threat to networks and information systems
The retail and gambling sectors have long understood the danger of the insider threat and have built their security frameworks to protect against both the insider and the outsider. Shoplifters are a huge bane to the retail industry, exceeded only by thefts from internal employees behind the registers. The cameras and guards in casinos are looking at both those in front of and behind the gambling tables. Casinos understand quite well that when an employee is spending 40 hours a week at their location dealing with hundreds of thousands of dollars; over time, they will learn where the vulnerabilities and weaknesses are. For a minority of these insiders, they will commit fraud, which is invariably much worse than any activity an outsider could alone carry out.
Insider Threat is mainly a book of real-life events that detail how the insider threat is a problem that affects every organization in every industry. In story after story, the book details how trusted employees will find weaknesses in systems in order to carry out financial or political attacks against their employers. It is the responsibility to the organization to ensure that their infrastructure is designed to detect these insiders and their systems resilient enough to defend against them. This is clearly not a trivial task.
The authors note that the crux of the problem is that many organizations tend to think that once they hire an employee or contractor, that the person is now part of a trusted group of dedicated and loyal employees. Given that many organizations don't perform background checks on their prospective employees, they are placing a significant level of trust in people they barely know. While the vast majority of employees can be trusted and are honest, the danger of the insider threat is that it is the proverbial bad apple that can take down the entire tree. The book details numerous stories of how a single bad employee has caused a company to go out of business.
Part of the problem with the insider threat is that since companies are oblivious to it, they do not have a framework in place to determine when it is happening, and to deal with it when it occurs. With that, when the insider attack does occur, which it invariably will, companies have to scramble to recover. Many times, they are simply unable to recover, as the book details in the cases of Omega Engineering and Barings Bank.
The premise of Insider Threat is that companies that don't have a proactive plan to deal with insider threats will ultimately be a victim of insider threats. The 10 chapters in the book expand on this and provide analysis to each scenario described.
Chapter 1 defines what exactly insider threats are and provides a number of ways to prevent insider threats. The authors note that there is no silver bullet solution or single thing that can be done to prevent and insider threat. The only way to do this is via a comprehensive program that must be developed within the framework of the information security group. Fortunately, all of these things are part of a basic information security program including fundamental topics like security awareness, separation and rotation of duties, least privilege to systems, logging and auditing, and more.
The irony of all of the solutions suggested in chapter one is that not a single one of them is rocket science. All of them are security 101 and don't require any sort of expensive software or hardware. Part of this bitter irony is that companies are oblivious to these insider threats and will spend huge amounts of money to protect against the proverbial evil hacker, being oblivious to the nefarious accounts receivable clerk in the back office that is draining the coffers.
One example the book provides is that many companies feel they are safe because they encrypt data. An excellent idea detailed in chapter two is to set up a sniffer and examine the traffic on the internal network to ensure that the data is indeed encrypted. The reliance on encryption will not work if it is not setup or configured correctly. The only way to know with certainty is to test it and see how it is transmitted over the wire. Many companies will be surprised that data that should be unreadable is being transmitted in the clear.
Some of the suggestions that authors propose will likely ruffle some feathers. Ideas such as restricting Internet, email, IM and web access to a limited number of users may sound absurd to some. But unless there is a compelling business need for a user to have these technologies, they should be prohibited. Not only will the insider threat threshold be lowered, productivity will likely increase also.
The author's also suggest prohibiting iPods or similar devices in a corporate environment. The same device that can store gigabytes of music can also be used to illicitly transfer gigabytes of corporate data.
Insider Threat provides verifiable stories from every industry and sector, be it commercial or government. The challenge of dealing with the insider threat is that it requires most organizations to completely rethink the way they relate to security. It is a challenge that many organizations would prefer to remain obvious to, given the uncomfortable nature of the insider threat. But given that the threats are only getting worse, ignoring them is inviting peril.
The only lacking of the book is that even though it provides a number of countermeasures and suggestions, they are someone scattered and written in an unstructured way. It is hoped that the authors will write a follow-up book that details a thorough methodology and framework for dealing with the insider threat.
Overall, Insider Threat is an important work that should be required reading for every information security professional and technology manager. The issue of the insider threat is real and only getter worse. Those that choose to ignore it are only inviting disaster. Those companies that will put office supplies and coffee under double-lock and key, while doing nothing to contain the insider threat are simply misguided and putting their organization at risk.
Insider Threat is a wake-up call that should revive anyone who doubts the insider threat.
Ben Rothke, CISSP is a New York City based security consultant and the author of Computer Security 20 Things Every Employee Should Know (McGraw-Hill 2006) and can be reached at ben@rothke.com"
You can purchase Insider Threat from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
The retail and gambling sectors have long understood the danger of the insider threat and have built their security frameworks to protect against both the insider and the outsider. Shoplifters are a huge bane to the retail industry, exceeded only by thefts from internal employees behind the registers. The cameras and guards in casinos are looking at both those in front of and behind the gambling tables. Casinos understand quite well that when an employee is spending 40 hours a week at their location dealing with hundreds of thousands of dollars; over time, they will learn where the vulnerabilities and weaknesses are. For a minority of these insiders, they will commit fraud, which is invariably much worse than any activity an outsider could alone carry out.
Insider Threat is mainly a book of real-life events that detail how the insider threat is a problem that affects every organization in every industry. In story after story, the book details how trusted employees will find weaknesses in systems in order to carry out financial or political attacks against their employers. It is the responsibility to the organization to ensure that their infrastructure is designed to detect these insiders and their systems resilient enough to defend against them. This is clearly not a trivial task.
The authors note that the crux of the problem is that many organizations tend to think that once they hire an employee or contractor, that the person is now part of a trusted group of dedicated and loyal employees. Given that many organizations don't perform background checks on their prospective employees, they are placing a significant level of trust in people they barely know. While the vast majority of employees can be trusted and are honest, the danger of the insider threat is that it is the proverbial bad apple that can take down the entire tree. The book details numerous stories of how a single bad employee has caused a company to go out of business.
Part of the problem with the insider threat is that since companies are oblivious to it, they do not have a framework in place to determine when it is happening, and to deal with it when it occurs. With that, when the insider attack does occur, which it invariably will, companies have to scramble to recover. Many times, they are simply unable to recover, as the book details in the cases of Omega Engineering and Barings Bank.
The premise of Insider Threat is that companies that don't have a proactive plan to deal with insider threats will ultimately be a victim of insider threats. The 10 chapters in the book expand on this and provide analysis to each scenario described.
Chapter 1 defines what exactly insider threats are and provides a number of ways to prevent insider threats. The authors note that there is no silver bullet solution or single thing that can be done to prevent and insider threat. The only way to do this is via a comprehensive program that must be developed within the framework of the information security group. Fortunately, all of these things are part of a basic information security program including fundamental topics like security awareness, separation and rotation of duties, least privilege to systems, logging and auditing, and more.
The irony of all of the solutions suggested in chapter one is that not a single one of them is rocket science. All of them are security 101 and don't require any sort of expensive software or hardware. Part of this bitter irony is that companies are oblivious to these insider threats and will spend huge amounts of money to protect against the proverbial evil hacker, being oblivious to the nefarious accounts receivable clerk in the back office that is draining the coffers.
One example the book provides is that many companies feel they are safe because they encrypt data. An excellent idea detailed in chapter two is to set up a sniffer and examine the traffic on the internal network to ensure that the data is indeed encrypted. The reliance on encryption will not work if it is not setup or configured correctly. The only way to know with certainty is to test it and see how it is transmitted over the wire. Many companies will be surprised that data that should be unreadable is being transmitted in the clear.
Some of the suggestions that authors propose will likely ruffle some feathers. Ideas such as restricting Internet, email, IM and web access to a limited number of users may sound absurd to some. But unless there is a compelling business need for a user to have these technologies, they should be prohibited. Not only will the insider threat threshold be lowered, productivity will likely increase also.
The author's also suggest prohibiting iPods or similar devices in a corporate environment. The same device that can store gigabytes of music can also be used to illicitly transfer gigabytes of corporate data.
Insider Threat provides verifiable stories from every industry and sector, be it commercial or government. The challenge of dealing with the insider threat is that it requires most organizations to completely rethink the way they relate to security. It is a challenge that many organizations would prefer to remain obvious to, given the uncomfortable nature of the insider threat. But given that the threats are only getting worse, ignoring them is inviting peril.
The only lacking of the book is that even though it provides a number of countermeasures and suggestions, they are someone scattered and written in an unstructured way. It is hoped that the authors will write a follow-up book that details a thorough methodology and framework for dealing with the insider threat.
Overall, Insider Threat is an important work that should be required reading for every information security professional and technology manager. The issue of the insider threat is real and only getter worse. Those that choose to ignore it are only inviting disaster. Those companies that will put office supplies and coffee under double-lock and key, while doing nothing to contain the insider threat are simply misguided and putting their organization at risk.
Insider Threat is a wake-up call that should revive anyone who doubts the insider threat.
Ben Rothke, CISSP is a New York City based security consultant and the author of Computer Security 20 Things Every Employee Should Know (McGraw-Hill 2006) and can be reached at ben@rothke.com"
You can purchase Insider Threat from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Another problem I've seen is execs granting themselves and their assistants way more access than they really need to do their job. It's a power issue for some of them. I run the company and should be able to get to anything.
That's not every company and SOX has made thinking about the consequences more attractive for the higher ups.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
I thought of hiding my root password from myself
Some have, some don't.
Usually those not in need of all their acess rights do have them for some reason. Those that would really need them have to go through the pain to fill forms and stuff..
I've experienced working at a place where an employee walked out with information (and was subsequently sued into oblivion). Afterwards, all computers were locked down to the point where it made it nearly impossible to get any work done. Ever try to troubleshoot a data issue when you have to get your supervisor to log you into the database server every time? It can be hard to find a happy medium.
Another recent book on the same topic: Extrusion Detection: Security Monitoring for Internal Intrusions . Haven't read it yet, but looks interesting.
(Although when I read the title, I kept thinking of detecting things that are extruded. WARNING! SILLY PUTTY FUN FACTORY DETECTED.)
I hate books like this. Management reads stuff like this and starts making it difficult for employees to get any work done. Worse yet is if they start trying to take away the IT department's power. In every environment I've ever worked in, I've EARNED the trust of my fellow geeks and been given access gradually. I dont abuse it. A good IT department never fully trusts anyone. I never fully expect to be trusted. These kinds of books just complicate that delicate geek balance.
is that I would want access in case, for whatever reason, I had to throw the admin out the door and get someone else to his job.
A good security policy protects admnistrators too... if something happens you will be less likely to get blamed for something you didn't do.
Please sign petition to restore sanity to our banking system!!!
http://financialpetition.org/
The problem is that within information technology, many users have far too much access and trust than they should truly have.
Yes, which is why we "need" Trusted Computing(tm) which will solve all of our problems.
The theory of relativity doesn't work right in Arkansas.
Think about AOL. There were and are tons of external threats and intrusions in their systems. But who makes headlines? The contractor who had access to the big database o' screennames.
Security 101 indeed.
This sounds bogus to me.
I doubt many companies are "oblivious" to the insider threat, it's just considered an acceptable cost of doing business. For example, a grocery store I used to work at knew perfectly well that their employees were lifting candy from the bulk candy dispenser (to pick an example). But they also knew the money they lost on that was significantly less than the cost of installing cameras and paying someone to review the tapes, or than the cost in lost sales of eliminating the bulk candy dispenser. So, when someone was caught red-handed, they were read the riot act (at least) or outright fired (at worst), but no special effort was made to catch people.
I don't think the owners of that grocery store were business prodigies, either. My guess is that the same sort of logic applies to most employers: the cost of preventing the infraction is higher than the cost of allowing it. The truth of this is reflected in which industries do protect themselves against the "insider threat": places like casinos, where a successfully criminal insider could lose them huge quantities of money.
Meanwhile, the book seems to make the same suggestion a lot of security experts do: if a user doesn't need the technology, then don't let them use it. This sounds good, but it carries costs, too. First, of course, the cost of setting up and maintaining a network that enforces such policies. But second, the cost in employee morale, which cannot be discounted. Another job I had not all that long ago was in an office that didn't allow its employees to listen to talk radio. Music was fine, but talk radio was too much of a distraction. Since you didn't need it to do your job, you weren't allowed to have it.
The effect on morale was, to put it mildly, negative. Honestly, it's one of the reasons I didn't have the job for very long. Email and internet access are similar: employees have become accustomed, rightly or wrongly, to some personal use of these technologies. Take that away, and you're sure to end up with disgruntled employees, no matter how rational your reasons.
Moreover, it's a question of trust. If you demonstrate to all your employees that you don't trust them, odds are good you'll increase the number of employees who will live up (or down, if you prefer) to your expectation. At best, you'll incur the costs associated with high turnover rates. At worst, you'll fall victim to even more pernicious crime than you otherwise might have.
I guess the point is, it's not necessarily ignorance or even apathy that causes businesses to be vulnerable to insiders, it's simple cost/benefit analysis.
Reality has a conservative bias: it conserves mass, energy, momentum...
"But Insider Threat is one of the first to deal with one of the most significant threats to an organizations, namely that of the trusted insider. The problem is that within information technology, many users have far too much access and trust than they should truly have."
These guys are right, but how am I supposed to trust them?
He who knows best knows how little he knows. - Thomas Jefferson
He says there's 10 chapters, but I only see two mentioned in the summary... and not even a suggestion of what may be in the other eight.
Find Nearby Indie Events
This book is total crap and their conclusions about trusted insiders are all wrong. I know this because a friend of mine who worked at the publishing house leaked me a copy a few months early...
never mind
Fear is the mind-killer. Fear is the little-death that brings total obliteration.
Reality has a conservative bias: it conserves mass, energy, momentum...
The real problem with not giving much trust to insiders is that then you're left with a situation where you're trying to do your job but you run into a problem of lack of access. One of the two people who can give you access is on vacation. The other one is in meetings all day. You're stuck playing minesweeper instead of doing real work. I can't tell you how many times I've run into this type of situation, and it kills productivity.
Save yourself about FOUR BUCKS by buying the book here: Inside Threat. And if you use the "secret" A9.com discount, you can save an extra 1.57%!
Ive worked as a tech for 3 different companies since i moved over here to the states 2 years ago and in ev ery single company the CEO has his logon password on a post it note or equivalent and stuck to his monitor.. now thats secure! not saying its an american thing so please dont flame me :P im sure it happens worldwide.. maybe Gates does the same thing.. haha
*Gratuitous Sig/Plug* Heres my website - firesuite
But Insider Threat is one of the first to deal with one of the most significant threats to an organizations, namely that of the trusted insider.
This subject has been discussed in countless basic, and not so basic, security publications. Not that it isn't a real problem, but this is hardly ground breaking.
The main issue is that most people can look at any patient. This is considered a "necessary evil" as sometimes unexpected clinicians might be looking at a patient's information and we don't want to block access in a life threatening situation. Instead, we review access after the fact, in addition to putting certain blocks in place:
- Unusual access is audited. This includes people looking at patients who happen to be employees, specific audits of local celebrities, and so on.
- Random audits. Periodically, someone will check to see what a random person is doing.
- Probation. New users are audited at certain points, to make sure they're not abusing their new power.
- Hiding patients Certain patients are hidden from most users - this might include celebrities, legal issues, or patients who have requested it.
I see trust as a necessary part of functioning within an organization, though trust must be tempered with watchfulness. I'm a big fan of letting people do what they want, and then "break their kneecaps" if they abuse that trust. In real terms, this means prosecution and the like. Of course, I don't decide such things - that gets passed on to our legal department and I try not to follow up after that.We had a situation where the CEO's assistant was giving his private emails to a former employee with whom she was having a 'relationshp'
What she basically did was 'backup' his outlook email to a PST and then burn the PST files to DVD-R
The IT fellow caught her in the act of 'backing up' our boss' email when he was away
She was caught and admitted to her wrong-doings
Supposedly legal action was going to be taken, but I changed jobs in the meantime
We may have had a bit of corruption with a major Word Doc from a specific user who likes to change her themes with any theme she can d/l, this time it was Holiday stuff. Not too mention numerous search bars, smiley faces, and other garbage. Anyway, either that caused an issue with her PC or it was simply user error on her part that ruined the document. I go with user error.
But I did offer to turn off the ability of users to install programs, but the boss said no, too big brotherish. Of which I replied, you lose time fixing things and re-doing things cause of breaks such as this.
Well, they can still load what they want, so like someone else said below/above, it's all power play, and then I have to fix it when they break it.
Trust no one.
With all the large hard drives we have today, we should record video of every keyboard induced update.
Free Web based FTP
The editors have too little grasp on English than they should have.
With spending like this, exactly what are "conservatives" conserving?
"Thousands of computer security books have been published that deal with every conceivable security issue and technology." If that were the case, wouldn't there not be any security issues?
The problem is that within information technology, many users have far too much access and trust than they should truly have.
God I'd hate to live in the world you would create.
Why stick up for big business?
I'm trying to figure out if you're attempting to be sarcastic in places or not, but I'm still not quite sure.
The keys need to be held by only a small group of people. "Too many cooks spoil the soup" applies very well to a corporate network, even down to the workstation configuration. It's possible to screw up the whole enchilada from that point too, ore at least have some major negative effect, and it's much better that if the intent is for it to be a managed network for it to be managed, dammit. If not, it's a free-for-all.
Many of my users are very smart people. Unfortunately, they're good only with their own home PCs. They don't understand why we don't always do things the same way that they themselves do them, nor will they until they come to appreciate the demands that present themselves in trying to keep a 30,000 computer network up and functioning for everyone despite their different needs. Where I work, our network is supported by ten field and bench technicians, two data cabling technicians, two telephone system technicians, and four helpdesk persons as far as interface-with-the-user support is concerned. Our back end is four network engineers, four software specialists, one AS/400 administrator, two Computer Operators, and a slew of programmers to write the software that the users will do their jobs with. It's a very, very small department given the size of the organization, and if we had better, tighter control over the security of the workstations it'd be a much easier job.
Do not look into laser with remaining eye.
You obviously loved Lou Rawls.
Love is a hurtin' thing.
Here we go again. Yet another book claiming that companies can't trust their employees, as if we're all crooked and evil (and not merely underpaid and mistreated, but that's another story). ANOTHER book justifying management treating us like shit. ANOTHER book telling the bosses what they want to hear. Hooray. And it's in a book so It Must Be True.
Meanwhile, over here IN REAL LIFE, people like me are running a company's entire business, with full access to everything, and yet, we don't break the law! We don't even BEND the law. How can we explain this bizarre paradox? Because if our collective bosses were to admit that their IT staff possesses PROFESSIONAL PRIDE, and MORALS, and A DESIRE TO DO THE RIGHT THING ALL THE TIME, NOT JUST WHEN IT'S GOOD FOR BUSINESS, well, that'd just be chaos! I mean, our whole society would fall apart if we admitted something like that!
What to do, what to do... The book says we're evil, common sense says we're not... What's a manager to do?
Oh! I know! Follow the book! That was easy...
Farewell! It's been a fine buncha years!
No, then you wouldn't get in. Just change the password every week and hide it in the top drawer of the computer in a quite public place. It worked for the administrators at Snohomish High School in Wargames, so it will work for you too.
I can't tell you how many times I have sat there doing nothing but billing a client because I didn't have security to a system. There is always just one guy who can give you access and he is on vacation. I can't tell you how many times I wasn't able to fix a production system because we needed some DBA to run some SQL script I wrote to fix the system. It's not like the DBA even looks at the scripts. I could've stuck in a statement to delete all the tables and he wouldn't have known. My last client had to give you MAC address to Server name security access. My motherboard fried so my MAC address changed. Of course server guy is on vacation. Eight hours X $150\hr = where is the savings? I know the majority of /. is UNIX/NT admin guys and not programmers so I probably won't get anybody to understand. It's safer for the admin guy's job to lock your system down then worry about development costs. If management really knew the additional software costs, developers wouldn't be locked down. Often it seems the admin guys have some kind of power trip with access. Am I really more of a security threat than the admin guy with lots of Lord of the Rings crap all over his cube?
'IT' needs access to do its job. We need *total* access to all systems and data or we cant be effective and might as well not goto work.
Anyone that stands in the way of this should be fired.
If you cant trust your IT people with this access, then they should be fired.
As far as the owner having total access, well its his f-ing place. HIS butt is on the line.. He gets what he wants, always. Deal with it.
---- Booth was a patriot ----
In one summer I worked on one company's financial department. Head accountant there didn't have full access to all information she needed. Reasons for that weren't security related, they were finanacial. Company didn't want to pay for a additional license to our software provider. Result was the she had to ask me to fetch each time information on system she didn't have access to.
Funny thing was that she was one of the permanents, while I was a temp that was hired through a recruiting firm. Never did go an interview in that company. Still I handlet quite big sums and had wider access thant she had as a head accountant.
I think one should look company's security package as a integral whole that is tightly knitted to each company. Reason is that companies have wildly diffrent kinds of organizations, ways of doing and needs. So the way each worker is allocated rights and accesses, varies by each company, by worker's function and software he or she uses. Not only that, many CEO's or department's heads don't really know how daily work is organized in the grass root level. It easily happens that CEO and IT manager/consultant get common agreement how to do security, but if they aren't up to date about regular daily practices problems can arise quicly. Ones that are born when people can't get necessary information when they need it.
These things, if wanted to do well, don't have one-size-hat-for-all solution and go far beyond being 'just' IT.
Besides there are lot of other issues here too, like labour relations and work effiency. Good and very tight security may not earn trust of workers, but cause it being lost. Too rigid and wrong headed security practices, can hinder real life productivity too.
Remember, road to hell is paved with good intentions. Tread carefully.
Nobody knows the trouble I've seen, nobody knows has the trouble seen me, even I sometimes wonder why I write these line
I have to agree. I work for a school district where I have complete access for every workstation as well as every server. True, I am a computer tech here, but still, the few things I do on a server shouldn't give me access to pretty much turning it into a FUBAR machine. Office staff and District Office personnel are even worse. They have full access to whatever they want on their machines. And all they do is use MS Office and a few programs for the district. Though it is kinda fun to search the server drives for *.mp3 and *.wmv and burn it to CD to enjoy at home. I have gotten some great music and really funny videos from their network folders, and then deleted them because its against district policy to have that stuff on work property =P.
Click Click Bloody Click PANCAKES!
Once I was asked by a friends father who he could trust to run his IT department and I told him "you can trust no one" and he told me "East, everyday I trust Jesus Christ as my Lord and Savior" and I simply asked him "Is Jesus your SysAdmin?". I don't think I ever spoke to the man again...
...Is that Zen or what?
Dedicated Cthulhu Cultist since 4523 BC.
--Andrew Williams
Publisher
Syngress Publishing
at least anyplace I consult for that I make use passwords that change every month and use password complexity
Vote Quimby!
The Internet is an enabling technology.
The Internet is not secure.
And it does not need to be.
It was not designed so that large corporations could sell security services on it.
The Internet is an open field. A common.
If you want the Cone of Silence, you know where to find it.
This was the policy at one site I worked at. One day I had to ask a fellow worker to show me some bad data on their workstation. They had gone home for the day, but a nearby cube dweller helped me out.
The password for the month (in that entire office) had been agreed to be abcyyyymm or some such where abc is known to everybody and the rest is just the date.
http://michaelsmith.id.au
here you go, this is a one sentence version of this book
DON'T let asshole people know important shit!
thanks!
"I'll be outside, since you're already on the cross..."
One of the wisest comments I've heard on security was: security is the tax that the rest of us pay because some people are immoral.
Security has a definite cost. Casinos are probably the extreme example. They tend to hire people paid an hourly wage who handle large amounts of money. Perhaps they have little choice but to watch them all them time. The people who are working at the casino are generally willing to put up with a total surveilance work environment because the jobs pay better than most relatively unskilled jobs.
I have not read the book that was reviewed, but the reviewer seems to sugget that something like this kind of total surveilance environment is desirable. The problem is that such an environment exacts a cost from the majority of honest and moral people in the hope that it will deter or catch those who are dishonest. A heavily restricted surveilance environment is likely to drive anyway many people who have other job options. As espionage scandels have shown, there is never any guarantee that any set of counter measures will assure that someone does not betray trust.
There has to always be a balance between risk and the cost of the security measures. Security "professional" like the reviewer seem to forget this. After all, it is not their problem when people quit for a more pleasant environment or when the organization cannot attract highly qualified people who can choose to work elsewhere.
The parent comment uses the example of bulk candy being lifted from a grocery store. This is an extreme example that doesn't accurately describe the situations that are addressed by the book. The comment also states that the issue at hand is a simple "cost/benefit analysis".
What I can say is that protecting a company's financial information or intellectual property is of much greater value to our company than some missing inventory. I also know that after having read this review, I am interested in understanding more of the possible loopholes or weak points in our infrastructure. The use of technology in the work place has increased dramatically and some of its applications demand more sophisticated precautions. Video cameras and the like are inadequate to the task.
At the least, I would hope to garner more ideas on how or where to look for shortcomings in our organization. Whether or not to implement them would _then_ come down to cost/benefits.
One big problem is how we are specifying permissions.
We usually specify who can, or can not, access or modify an object.
So if I want to say 'back up what is important to me', the computer can't do it.
Or, show me 'things which contain financial information', the computer is again lost.
Policies with higher level attributes (either applied to an object, or inferred by content scanning) makes a bit more sense to me, and probably easier to manage.
I would like a flikr like meta-data tag search. Maybe this will be possible with WinFS. It would be more useful if it wasn't entirely free-form, and some template tags and groupings for things like projects and interests were also easily managed.
Anyone know if WinFS is going to be able to take us in this direction?
Here in Belgium it's not that bad. I've worked in a company last summer (as a student, just for one month). First thing I had to do was to sign an agreement not to steal anything yada yada. Then they gave me my account (administrative rights) and the password for local admin on the workstations. I could log in to any server I wanted, I even got internet access (albeit monitored). I've heard from others (friends of mine) that worked in other companies, same thing happened. Doesn't look like they're worried about passwords and stuff :)
After 5-plus years at my current position, I've been looking at possibly moving on. And I am amazed at how many companies now require "background checks", including access to one's financial and credit history over the course of one's employment. All for the sake of "trustworthyness" and verifying "lack of exploitablity".
I always refuse to sign. First of all, trustworthyness can be verified by current (who knows I'm looking) and previous employers. They're called references for a reason.
Second, no company has a need-to-know regarding my--or anyone else's--financial and credit history.
This is some of the most sensitive information people have, to just release to unknown individuals within a company. Before people state that companies are seeing me--and others--in the same way, see my previous point about "references".
Besides, if the applicant is married, the company does not have the authorization to search the spouse's information. And the spouse may be the exploitable person--via drinking, gambling, drugs, overspending, etc. Or the kids. Or the parents. Or the siblings. Getting the picture?
People just need to refuse to sign these forms, and wish the companies good luck finding someone. Of course, they're likely chasing away the very people who understand security.
Chalk it up to lazy HR people and further attempts at control.
Ohhh, it's just a book review. Because from reading the article title on the RSS feed, I thought there was a specific "insider threat" being reported on.
Web 2.0 == Giant Blogspam Circle Jerk
I hate to point it out to you, but company rules (and government laws, btw) are not written for those who are already doing good. They are written to limit the impact that someone who lacks your good behavior.
Other posts have commented about the balance involved, and it is a difficult one to strike. In many cases, the official geeks (i.e. IT staff charged with maintaing the systems, etc.) need greater access, but part of the company's process should include a method of documenting who gets such access, why it is needed, and who takes responsibility for granting the exception. When done properly, this can mean that Joe Secretary is a limited user that is unable to install software on his computer, but Jackie Systemanalyst has local admin privileges so she can install and test the new version of Software X.
Simple fact is, unless your company has only one employee, it is unlikely that any rule will fit 100% of the employees 100% of the time. The job of security/compliance/auditing is to ensure that all of the rules are applied in a standard fashion and that those exceptions are adaquitely documented in a way that allows a) figuring what went wrong and b) who to fry for it when an employee abuses their position.
I'd have to say that this is actually blown a tad out of proportion.
I used to work as a HelpDesk Technician for a school. This job was a tad different than ordinary HelpDesk positions at other places. I didn't handle problems over the phone. I'd walk to the office and fix it there. Now to do my job I was told the password for the built-in admin account on every machine. I was just a volunteer too.
However, I often needed to get into someones office when that person was absent. So I had to call security and and have them let me in. The reason was because they would not let a student have a key. So I can have the admin password to every computer and for some reason, no key. I've spent countless hours waiting for security. Though to be fair, only the admins had control of the servers. These particular admins aren't stupid.
Now, the one thing I did the most was clean spyware off of computers. I have found 200 and more peices of spyware (and by spyware I mean adware + spyware, etc.) on administrative computers and in security. The administrative department uses passwords and enters student information. This means that the school was broadcasting private, personal, and sensitive information to some joe nobody knows.
Oh wait, leaking personal student information poses no cost whatsoever to the school. Nevermind.
A Better solution is to do the following:
- Hire good employees, who are relatively honest and straightforward people. This includes everyone -- IT, Sales, Administrative, etc. If they arent honest, they shouldnt be working here. (This also tends to help with Corporate Responsibility -- how NOT to fudge the books in a crunch..) There are decent HR personality tests that can reasonably predict if someone would be untrustworthy in different situations.
- Deal with your employees fairly, honestly, and be upfront. This will minimize the biggest source of insider problems -- disgruntled employees. For example, giving yourself a raise after or just before laying off other employees, is generally a Bad Thing (tm). Try to be honest with employees about their performance, what is expected, and what wont fly. Provide regular, upfront feedback. Follow through with action. Be Kind, Understanding, but Firm.
- Trust your employees to make sound decisions. The employee who is berated and treated as if they "cant be trusted" will eventually turn into the employee who you fear them to be. If you dont trust them to start, then why should they care? More over, if you dont trust them, why did you hire them?
- Give people ample access to what they need, but not so much access that it impedes others. For example, the IT administrator should have access to quite a bit. Asking for a password to do their job is no only unefficient, its demeaning and downright stupid. Do you trust the IT people you have hired? Do you believe them to be competent? If so, then let them do their job. If not, then why did you hire them or why are they still working there? Its incredibly frustrating to employees to do what this book reccomends -- lock down access. Its frustrating to the employee becuase they have to "ask" to do their job. And its frustrating to management, who has to constantly hand-hold entering passwords as the employee progresses. Cut the leash.
Overall, I think its important for IT security people and Management to understand these risks. TO watch for violations. But to base your company security policies on these type of ideas would be lunacy, and would kill any sort of company morale you might have had going for you. Its much easier to trust the people you work for, pay them fairly and well, and treat them like human beings than it is to try to lock them down in every way to "prevent" bad things.
Certainly there are exceptions where even the very small percentage of bad employees can cause very large damage to the company. This should be dealt with appropriately within those industries -- and employees should know this DURING the application process, so they know what kind of BigBrother situation they are getting into.
B
And how many times has this been tried and yet when its most important you get the call 'can you fix this file for me'? Most every time.
Nope, no encryption allowed on my network, unless i hold the key.
If any data is missing, you will be accused regardless. You are the computer guy remember, its ALWAYS your fault.
---- Booth was a patriot ----
I started in the computer industry in the mid '70s, and this problem was old even then. The mindset I was taught wasn't to lock everything down, so that no-one can do anything; it was to design, wherever practical, systems and processes to require collusion to break them. Give people the authority and access that they need to do the jobs they have to do, but share the roles out. Set everything up so that it takes at least two people to rob you blind, or to delete all your files and backups, or whatever, and you'll be vastly safer. One person with the power to do everything is a risk, because there *will* be bad apples; once that person has to get someone else to go along with them, though, whilst the risk doesn't disappear completely, it's tiny by comparison.
The intranet is not the internet.
And the main subject of the book does not address the internet.
It was not designed to address internet security.
The intranet is not an open field. (P.S. Ever hear of the "tragedy of the commons"? Calling the internet a common is, to say the least, unnerving.)
If you want the award of irrelevance, continue commenting.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
IT' needs access to do its job. We need *total* access to all systems and data or we cant be effective and might as well not goto work.
While I disagree with the whole of this statement, I disagree most vehemently with the part in bold, so I'll address that.
In world that cared about data security, NO EMPLOYEE WOULD EVER BE GIVEN ACCESS TO CUSTOMER DATA THAT WAS ONLY USED TO DRIVE THE APPLICATION. Take a look at the ideas in the book Translucent Databases (actually, even just read the summary on that page) and you'll get an idea of what can be done to minimize the risks posed by insiders. If your company deals with a lot of customer data.. let's say it has an ordering system like Amazon's.. there is NO employee in the company, not the CEO nor the CTO, who needs to know what your customer's credit card number is, or needs to be able to find out. Encrypt it so that only the customer's password can retrieve it (and that password, btw, is only in the customer's brain, because you're only storing a hash of it) and you've just eliminated the single biggest privacy threat in information systems today. The same goes for a wide variety of information about the customers which no employee ever needs to know.
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
Dont try coming to work for me is all i have to say about that.. You wouldnt last 10 minutes. ( if you even got hired )
If the CEO wants the data, its his to have. Period. End of disscussion.
---- Booth was a patriot ----
Fair enough. Maybe your book IS balanced. I'm not going to buy it to find out, of course... But you do realize that this sort of book traditionally sets management and employees at odds.
Who reads it? Management, which feels above reproach and won't consider itself to be a threat even if your book has a whole chapter entitled "Management: A Threat".
Who suffers from it? Mostly the IT department, because they're closest to the data, they're usually not politically connected at all, and Management doesn't know how their jobs really work, so they're mysterious and spooky.
Joe Manager isn't going to pick on his sales staff. He understands them. He gets along with them. They go drinking together. The same goes for his fellow managers.
Joe's going to pick on the weirdos in the IT department. He's going to read your book and think "they have control over MY database! They're weird and different, and I don't drink with them! Somebody must DO something!"
And, just like that, your so-carefully-balanced book becomes a tool for management to use against employees, usually by justifying the implementation of ridiculous, poorly-thought-out policies designed to "get those people under control". It's just basic human nature, and it's disingenious for you to say it doesn't work like that.
Whenever I hear about a book like yours, I think "what's he selling me?" Because anytime someone tells you you should be worried about X, they're about to sell you Y.
Of course, what you're selling is a BOOK.
Farewell! It's been a fine buncha years!
"He's got a shoe! A SHOE!"
Farewell! It's been a fine buncha years!
In my 30+ years of experience working in IT I've found that companies can be run in basically two way when it comes to the question of security. One is to be anal retentive and implement restrictions on everything so that you can't breathe; this creates a climate where nobody trusts each other, and of course it breeds resentment etc.
The other way is to trust everybody - that tends to make people feel responsibility for the company, the team, the project or whatever. This doesn't mean that everybody should have root access to every server, what I am talking about is the difference between armed guards/barbed wire and a polite notice saying 'Please don't walk in the flowerbeds'. I think about 99% of a company's employees want to do the right thing and don't want to mess around with things they shouldn't; and the 1% who want to mess around will do so no matter what security measures are in place.
I was a systems programmer in one place with ultra high security: 3 levels of security zones, even system programmers couldn't go to the 3rd level (but all the bosses, of course, althought they didn't know a thing about the systems). This was a mainframe shop with VM at the bottom and a number of MVS systems on top of that, a fairly common setup I believe; as I said I couldn't get access to important datasets without written permission from somebody higher up. On the other hand, I had the VM console on my desk and could access everything without even being logged anywhere; that just goes to show how fragile these security measures are. They are generally thought up by incompetents in the financial departments, and you can often walk right through them.
And at the end of the day, you still have to trust somebody; so why not do it properly and make a climate where trustworthyness is a natural thing?
Ppl work for money usually more than other things. Hire qualified, professional IT staff. Give the higher up IT ppl the money and respect they deserve, and they'll protect your data and your company. Who else is going to protect it but them?